352e8c3e44c8f2ed8b112c64d9ee4a28a8a8a7f4e2b116707d495fb4b252df9c

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-16 19:57:20

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegCloseKey
  • RegOpenKeyExA
  • RegQueryValueExA
 Possibly launches other programs:
  • CreateProcessW
 Uses Windows's Native API:
  • NtClose
  • NtCreateFile
  • NtDeviceIoControlFile
  • NtLockFile
  • NtQueryObject
  • NtSetInformationFile
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Interacts with the certificate store:
  • CertOpenSystemStoreW
Malicious VirusTotal score: 53/70 (Scanned on 2026-10-23 18:42:32) ALYac: Generic.Dacic.11262.0B9A6096
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Malware/Win.Dacic.R765588
Alibaba: Trojan:Win64/Convagent.7497d3a3
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Generic.Dacic.11262.0B9A6096
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Generic.Dacic.11262.0B9A6096
Bkav: W32.Malware.112B5441
CAT-QuickHeal: Trojan.Win64
CTX: exe.trojan.convagent
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
DrWeb: Trojan.DownLoader49.40340
ESET-NOD32: Win64/FakeTool.C trojan
Elastic: malicious (high confidence)
Emsisoft: Generic.Dacic.11262.0B9A6096 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W64/Agent.MCC!tr
GData: Generic.Dacic.11262.0B9A6096
Google: Detected
Gridinsoft: Trojan.Win64.Agent.oa!s1
Ikarus: Trojan.Win64.Agent
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Kaspersky: HEUR:Trojan.Win64.Convagent.gen
Kingsoft: Win64.Trojan.Convagent.gen
Lionic: Trojan.Win32.Dacic.4!c
Malwarebytes: Trojan.Loader
MaxSecure: Trojan.Malware.121218.susgen
McAfeeD: Trojan:Win/Dacic.EBP
MicroWorld-eScan: Generic.Dacic.11262.0B9A6096
Microsoft: Trojan:Win64/Convagent.RVA!MTB
Paloalto: generic.ml
Panda: Trj/GdSda.A
Rising: Downloader.Agent/x64!1.1498F (CLASSIC)
Sangfor: Trojan.Win64.Convagent.Vgsz
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.10c46679
TrellixENS: Artemis!117D5AE9950A
TrendMicro: Trojan.Win64.FAKETOOL.USBLJH26
TrendMicro-HouseCall: Trojan.Win64.FAKETOOL.USBLJH26
VIPRE: Generic.Dacic.11262.0B9A6096
Varist: W64/ARisk.PQ
ViRobot: Trojan.Win.Z.Dacic.1139712.RJ
Webroot: Win.Trojan.Gen
alibabacloud: Trojan:Win/Convagent.RYZ2XJC
huorong: Backdoor/Agent.rv

Hashes

MD5 117d5ae9950aaf2b06c36467e572b4e5 🔍
SHA1 980a18d4065cfb02d27a0e149dba853b44b02315 🔍
SHA256 352e8c3e44c8f2ed8b112c64d9ee4a28a8a8a7f4e2b116707d495fb4b252df9c 🔍
SHA3 1f7029b8ea11912abeb973ac465f6932ce3d7a88aa04e4b7b660674d4dcba9e2 🔍
SSDeep 12288:Rbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDxvfqItNqdg:RbOVE5ifGPRZwVvf3fd 🔍
Imports Hash 73f461c771aef77ec43d53a0c54f0c8d 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-16 19:57:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x75400
SizeOfInitializedData 0xa0c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x11c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4805b8ccce84685fe4530a58a8d231e3 🔍
SHA1 95a7b04c41576916d0ac0288bf8605d5c31eb579 🔍
SHA256 24ebe676b71ee6b6cb8688d2a894ca1be55bc90f9beb11e8780bbc072425d338 🔍
SHA3 799df72a55efd5db178edb71b89333a67d08d735b03ae82de5d52719e5112ae6 🔍
VirtualSize 0x75286
VirtualAddress 0x1000
SizeOfRawData 0x75400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36945

.rdata

MD5 2948bc562f941899245ce7eefc78239e 🔍
SHA1 6ca6e0691073a8de782d6563ab067fe031a9cf60 🔍
SHA256 fdd5545b533cd48994d97d03bcd9fedd35ae5e689d7d945a7f90f8a962b8d0b3 🔍
SHA3 4c05c1901f50b83953e579cb6d8f30cadb2ffe8e24255d4eb69ea693e6a6ab6f 🔍
VirtualSize 0x9c5a0
VirtualAddress 0x77000
SizeOfRawData 0x9c600
PointerToRawData 0x75800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.08547

.data

MD5 a13d039c43daffca9acd20a4cbed5310 🔍
SHA1 f30592fddfb9b43877aaf272169fb63eab4a9d79 🔍
SHA256 abf459a36b81847fdb2450b94e80bc9663e8e17de149f9d468c0f88828ac0d9c 🔍
SHA3 7316759545f6fc8fbc1e3da0baef19275347ce0e691da1b03f46d9d0e1f54bbc 🔍
VirtualSize 0x780
VirtualAddress 0x114000
SizeOfRawData 0x800
PointerToRawData 0x111e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.75727

.pdata

MD5 d5a6d76f34c7753a6619ce8e1e8189fd 🔍
SHA1 ebc0f1a8fbb2f3743f6c4ab4cee3491695970e63 🔍
SHA256 1d56fca469f24149ff128a4797a631ade1dbf0ca8b333a246c2929868e112d6d 🔍
SHA3 155e69466cbf9a7b67d6da17abc8816bab302a6b0bfe44dfd18b1718d07070c4 🔍
VirtualSize 0x13f8
VirtualAddress 0x115000
SizeOfRawData 0x1400
PointerToRawData 0x112600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80006

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x117000
SizeOfRawData 0x200
PointerToRawData 0x113a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 d4163cd782027139760d0eb803098005 🔍
SHA1 8be6c130911dd3328555930f4b13db76d4b65066 🔍
SHA256 bf09ac4ea974dffd64ea60096241978f8774580594a40cbba53630fcff37bddd 🔍
SHA3 d73b0ce6b63ab03d4bcff3cbda4d2efe32e258bcad61fb32f90083c96758bec1 🔍
VirtualSize 0x2219
VirtualAddress 0x118000
SizeOfRawData 0x2400
PointerToRawData 0x113c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0100799

.reloc

MD5 aa7540e1601bc82bd90cea5f4c52ed0f 🔍
SHA1 7dc9be6e43734bf77d328d68290fe1189dea4f05 🔍
SHA256 73cffbcff84c03f5b021f968764c007fbc618a048a66bd6eced70099abad3af3 🔍
SHA3 1744bacd428d679c8af597b32ce1650285852e8fd2554abc3cfbca7af0b6da78 🔍
VirtualSize 0x2bc
VirtualAddress 0x11b000
SizeOfRawData 0x400
PointerToRawData 0x116000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.11754

Imports

ntdll.dll NtClose
NtCreateFile
NtDeviceIoControlFile
NtLockFile
NtQueryObject
NtSetInformationFile
RtlEqualUnicodeString
RtlExitUserProcess
RtlGetFullPathName_U
RtlWaitOnAddress
KERNEL32.dll AcquireSRWLockExclusive
CloseHandle
CreateProcessW
ExitProcess
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileAttributesW
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GlobalMemoryStatusEx
MoveFileW
MultiByteToWideChar
ReadFile
ReleaseSRWLockExclusive
SetEnvironmentVariableA
SetFilePointerEx
Sleep
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
ADVAPI32.dll RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SystemFunction036
CRYPT32.dll CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
WS2_32.dll WSAGetLastError
WSASocketW
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x518000
EndAddressOfRawData 0x51a218
AddressOfIndex 0x514000
AddressOfCallbacks 0x517000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4096BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.